1. Relevant Legislation and Competent Authorities

1.1 What is the principal data protection legislation?

The main legislation is Law no. 8/2005, of August 22 – Personal Data Protection Act (“Lei da Protecção de Dados Pessoais” in Portuguese, or LPDP) of the Macau Special Administrative Region (henceforth “MSAR”).

1.2 Is there any other general legislation that impacts data protection?

The Chief Executive Dispatch no. 83/2007, of March 12, (and ancillary legislation) created the Office for Personal Data Protection (“Gabinete de Protecção de Dados Pessoais” in Portuguese, or “GPDP”).

1.3 Is there any sector-specific legislation that impacts data protection?

Yes – Law no. 2/2012, of March 19, on the Legal Regime of video surveillance in public spaces (“Regime jurídico da videovigilância em espaços públicos” in Portuguese).

1.4 What authority(ies) are responsible for data protection?

The GPDP is the entity responsible for the monitoring and coordination of compliance with the LPDP, as well as for the establishment of an adequate confidentiality regime and the monitoring of its execution.

2. Definitions

2.1 Please provide the key definitions used in the relevant legislation:

■ “Personal Data”

“Personal Data” is defined as “any information of any kind and regardless of the respective format, pertaining to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, namely by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity”.

■ “Processing”

“[Data] Processing” is defined as “any operation or set of operations performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction”.

■ “Controller”

The term “Controller” does not exist as such in the LPDP. The closest definition pertains to the “[entity] responsible for processing”, which is defined as “the natural or legal person, public authority, agency or any other body which alone or jointly with others, determines the purposes and means of the processing of personal data” (henceforth “data controller”).

■ “Processor”

The term “Processor” also does not exist as such in the LPDP. The closest definition pertains to “subcontractor”, which is defined as “a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the data controller” (henceforth “data processor”).

■ “Data Subject”

“Data Subject” is defined as “the individual person to whom the data being processed pertains”.

■ “Sensitive Personal Data”

“Sensitive Personal Data” is referred to in article 7 of the LPDP, which prohibits the processing of personal data concerning political or philosophical beliefs, political or trade-union membership, religious faith, private life, racial or ethnic origin, as well as the processing of data concerning health and sex life, including genetic information, with the exceptions foreseen by the LPDP.

■ “Data Breach”

The term “Data Breach” does not exist as such in the LPDP – however, the law provides for the definition of wrongful or undue access as the unauthorised access to personal data by any entity who is not entitled to do so, and stipulates a penalty of imprisonment of up to one year or a fine of up to 120 days (with the aggravating factors indicated in the law and unless a more severe penalty exists by special law).

■ “personal data file” (“file”) is defined as “any structured set of personal data which are accessible according to specific criteria, regardless of the form or type of their creation, storage and organisation”;

■ “third party” is defined as “any natural or legal person, public authority, agency or any other body other than the data subject, the data controller, the subcontractor or the persons who, under the direct authority of the data controller or of the subcontractor, are authorised to process the data”;

■ “recipient” is defined as “a natural or legal person, public authority, agency or any other body to whom data are disclosed, whether a third party or not; however, authorities which may receive data in the framework of a legal stipulation or of a regulatory requirement of organic nature shall not be regarded as recipients”;

■ “data subject’s consent” is defined as “any freely given specific and informed indication of his/her wishes by which the data subject signifies his agreement to personal data relating to him being processed”; and

■ “interconnection of data” is defined as “data processing which consists in the possibility of correlating data in a file with the data in a file or files kept by another or other controllers, or kept by the same controller for other purposes”.

3. Territorial Scope

3.1 Do the data protection laws apply to businesses established in other jurisdictions? If so, in what circumstances would a business established in another jurisdiction be subject to those laws?

The LPDP only provides a territorial scope for its applicability regarding video surveillance or other means of capturing, processing and disseminating sounds and images to identify persons whenever the controller is domiciled in the MSAR, or uses a computer and telematic network access provider established therein.

Therefore, the LPDP shall apply in accordance to its material scope, i.e. it shall apply to the processing of personal data wholly or partly by automated means, as well as processing by non-automated means of personal data contained in or intended for manual files, regardless of the establishment of businesses in other jurisdictions.

Although the LPDP would de jure be applicable in the above case, the jurisdiction of the GPDP would de facto have implementation difficulties regarding a business established in another jurisdiction and with no presence in Macau.

4. Key Principles

4.1 What are the key principles that apply to the processing of personal data?

■ Transparency

Data processing shall be made in a transparent way and in strict compliance with the respect of privacy (article 2 of the LPDP).

■ Lawful basis for processing

Data shall be processed in a lawful way and in compliance with the principle of good faith, as well as with the principles enunciated in article 2 of the LPDP, which include the respect of rights, freedoms and guarantees in the MSAR, in international instruments and in existing legislation (article 5, paragraph 1, subparagraph 1 of the LPDP).

Article 6 of the LPDP further provides that the processing of personal data may only be carried out if the data subject has given his/her unequivocal consent, or if the processing is necessary for the:

1) execution of contracts or contracts in which the data subject is a party or prior to the formation of the contract or declaration of negotiation will be made at his request;

2) compliance with a legal obligation to which the controller is subject;

3) protection of vital interests of the data subject, if he/she is physically or legally incapable of giving his/her consent;

4) execution of a mission of public interest or in the exercise of powers of a public authority in which the controller (or a third party to whom the data are transmitted) is invested; and

5) pursuit of legitimate interests of the controller or third party to whom the data are transmitted, provided that the interests or rights, freedoms and guarantees of the data subject shall not prevail.

■ Purpose limitation

Data shall be collected for specific, determined and lawful purposes, which are directly related to the activity of the data controller, and cannot subsequently be processed in a way that is incompatible with those purposes (article 5, paragraph 1, subparagraph 2 of the LPDP).

■ Data minimisation

No specific stipulation – this principle is included in article 5, paragraph 1, subparagraph 3 of the LPDP (see “Proportionality” below).

■ Proportionality

Data shall be adequate, pertinent and non-excessive in relation to the purposes for which they are collected and processed (article 5, paragraph 1, subparagraph 3 of the LPDP).

■ Retention

Data shall be kept in a way which allows the identification of their owner only for the duration necessary for the purposes of collection or subsequent processing (article 5, paragraph 1, subparagraph 5 of the LPDP).

■ Other key principles – please specify

The LPDP also stipulates that data shall be exact and, if necessary, shall be updated, with the obligation to ensure that inexact or incomplete data are erased or amended, in compliance with the purposes for which the data were collected or subsequently processed (article 5, paragraph 1, subparagraph 5 of the LPDP).

5. Individual Rights

5.1 What are the key rights that individuals have in relation to the processing of their personal data?

■ Right of access to data/copies of data

The LPDP guarantees the right of the data subject to information regarding the identity of the data controller or its representative, the purposes of processing and other ancillary information (article 10 of the LPDP), as well as the right of access to all his/her data (article 11 of the LPDP).

No specific provisions exist regarding the right to obtain a copy of the personal data.

■ Right to rectification of errors

The right of access includes the right to rectify, delete or block data whose processing does not comply with the LPDP, namely in regard to the incomplete or inexact character of those data (article 11, paragraph 1, subparagraph 4 of the LPDP).

■ Right to deletion/right to be forgotten

See above regarding the right to deletion. Regarding the right to be forgotten, no specific provisions exist regarding such right. Please note, however, that under the LPDP, personal data shall be kept in a way which allows the identification of their owner only for the duration necessary for the purposes of collection or subsequent processing (as per the principle of retention above).

■ Right to object to processing

The data subject has the right to object at any time, under lawful and serious reasons relating to his/her specific case, that his/her data be the subject of processing, in which case, under justified objection, the processing shall not concern those data (article 12, paragraph 1 of the LPDP).

■ Right to restrict processing

Without prejudice to the right to object to the processing indicated above, no specific provisions exist regarding the right to restrict processing of personal data. Hence, as long as the data subject presents lawful and serious reasons relating to his/her specific case, he/she shall have the right to restrict processing.

■ Right to data portability

No specific provisions exist regarding the right to data portability.

■ Right to withdraw consent

No specific provisions exist regarding the right to withdraw consent. However, we are of the view that this right falls under the provisions regarding the data subject’s right to object to processing (as indicated above) and, therefore, the data subject may withdraw consent insofar as he/she presents lawful and serious reasons relating to his/her specific case to do so.

■ Right to object to marketing

The data subject also has the right to object, on request and free of charge, to processing of personal data concerning him/her for direct marketing or any other form of commercial prospecting, and also has the right to be informed in advance of any transfer of data to third parties for the purposes of direct marketing or usage for third parties, as well as the right to object, free of charge, to such transfer or usage (article 12, paragraph 2 of the LPDP).

■ Right to complain to the relevant data protection authority(ies)

The LPDP provides for the possibility to submit a complaint to the GPDP, without prejudice to the possibility of resorting to administrative or jurisdictional means to guarantee the compliance with legal and regulatory provisions (article 28 of the LPDP).

■ Other key rights – please specify

The LPDP also includes the right not to be subject to automated individual decisions (article 13 of the LPDP) and the right to an indemnity in cases of illegal processing of data or of any act infringing legal or regulatory provisions regarding data protection (article 14 of the LPDP).

6. Registration Formalities and Prior Approval

6.1 Is there a legal obligation on businesses to register with or notify the data protection authority (or any other governmental body) in respect of its processing activities?

Any data processing is subject to notification of the GPDP, to be made within eight days of the start of such processing by the data controller or by its representative (article 21, paragraph 1 of the LPDP).

If there is transfer of personal data to a destination outside the MSAR, the opinion of the GPDP must be sought to confirm if such destination ensures an adequate level of protection. However, the transfer of personal data to a legal system which does not ensure an adequate level of protection pursuant to the LPDP may be effected by means of notification to the public authority, if the data subject has given his/her unequivocal consent to the transfer, or if that transfer is necessary under the cases provided by law – i.e. it is necessary for the formation of a contract between the data subject and the data controller, for preliminary measures for the formation of said contract by request of the data subject, among others (article 19, paragraph 1 and article 20, paragraph 1 of the LPDP).

The processing of sensitive data or of data related to credit and solvency of its subjects, the interconnection of personal data and the usage of personal data for purposes which are not decisive to the collection of such data are subject to prior authorisation by the GPDP, without prejudice to legal or regulatory exceptions (article 22 of the LPDP).

6.2 If such registration/notification is needed, must it be specific (e.g., listing all processing activities, categories of data, etc.) or can it be general (e.g., providing a broad description of the relevant processing activities)?

Any requests for authorisation, notification or opinion sent to the GPDP shall contain the information provided by law, in particular:

1) name and address of the data controller and, if applicable, its representative;

2) purpose of data processing;

3) description of the categories of data subjects and data or categories of personal data concerning said data subjects;

4) recipients or categories of recipients to whom the data may be disclosed and under which conditions;

5) entity in charge of the processing of data, if not the data controller;

6) possible interconnection of processing of personal data;

7) personal data storage period;

8) form and conditions for data subjects to have knowledge of or to amend their respective personal data;

9) expected data transfers to third countries or territories; and

10) general description enabling a preliminary assessment of the suitability of measures taken to ensure the adequate level of protection under the LPDP (in accordance with articles 15 and 16 of the LPDP).

6.3 On what basis are registrations/notifications made (e.g., per legal entity, per processing purpose, per data category, per system or database)?

As previously indicated, any data processing (see “[data] processing” definition above) is subject to notification of the GPDP, regardless of the entity responsible for the processing, without prejudice to the cases where prior consent of the GPDP must be sought.

The data controller or its representative has the obligation to notify the GPDP, as per article 21, paragraph 1 of the LPDP.

6.5 What information must be included in the registration/notification (e.g., details of the notifying entity, affected categories of individuals, affected categories of personal data, processing purposes)?

Any requests for an opinion or authorisation, as well as notifications, sent to the GPDP shall contain the information indicated in subparagraph 2 above (article 23 of the LPDP).

In case of sensitive data processing (article 7, paragraph 2 of the LPDP), of the creation and maintenance of records regarding suspicions of illegal activities, criminal offences and administrative offences (article 8, paragraph 1 of the LPDP), and of requests for authorisation, as well as those pertaining to records of processing of personal data, these shall indicate, at least:

1) the person responsible for the file and, where appropriate, his representative;

2) the categories of personal data processed;

3) the purposes for which the data are intended and the categories of entities to whom they may be transmitted;

4) how the right of access and of rectification of data can be exercised;

5) possible interconnections of processing of personal data; and

6) expected data transfers to third countries or territories.

6.6 What are the sanctions for failure to register/notify where required?

The lack of notification or authorisation request as provided by the LPDP entails a fine of between 2,000 and 20,000 MOP for individuals and a fine of between 10,000 and 100,000 MOP for legal persons. The fine shall be increased to twice its limits in the case of data subject to prior authorisation (in accordance with article 22 of the LPDP).

6.7 What is the fee per registration/notification (if applicable)?

This is not applicable.

6.8 How frequently must registrations/notifications be renewed (if applicable)?

This is not applicable (without prejudice to the obligation to notify the GPDP regarding any new data processing).

6.9 Is any prior approval required from the data protection regulator?

As indicated above, the processing of sensitive data or of data related to credit and solvency of their subjects, the interconnection of personal data and the usage of personal data for purposes which are not decisive to the collection of such data are subject to prior authorisation by the GPDP, without prejudice to legal or regulatory exceptions (article 22 of the LPDP).

6.10 Can the registration/notification be completed online?

The registration/notification is currently not possible online.

6.11 Is there a publicly available list of completed registrations/notifications?

No such list is available.

6.12 How long does a typical registration/notification process take?

No timeframe currently exists for the procedure of prior approval.

7. Appointment of a Data Protection Officer

7.1 Is the appointment of a Data Protection Officer mandatory or optional? If the appointment of a Data Protection Officer is only mandatory in some circumstances, please identify those circumstances.

The appointment of a Data Protection Officer is optional – such possibility is not foreseen by the LPDP.

7.2 What are the sanctions for failing to appoint a Data Protection Officer where required?

This is not applicable.

7.3 Is the Data Protection Officer protected from disciplinary measures, or other employment consequences, in respect of his or her role as a Data Protection Officer?

This is not applicable.

7.4 Can a business appoint a single Data Protection Officer to cover multiple entities?

7.6 What are the responsibilities of the Data Protection Officer as required by law or best practice?

This is not applicable.

7.7 Must the appointment of a Data Protection Officer be registered/notified to the relevant data protection authority(ies)?

This is not applicable – however, this information shall be included in the notification to be submitted by the applicant to the GPDP (see above).

7.8 Must the Data Protection Officer be named in a public-facing privacy notice or equivalent document?

This is not applicable.

8. Appointment of Processors

8.1 If a business appoints a processor to process personal data on its behalf, must the business enter into any form of agreement with that processor?

The LPDP stipulates that, where processing is carried out on the data controller’s behalf, said data controller must choose a processor providing sufficient guarantees in respect of the technical security measures and organisational measures governing the processing to be carried out, and must ensure compliance with those measures.

The carrying out of processing by way of a processor must be governed by a contract or legal act binding the processor to the controller and stipulating, in particular, that the processor shall act only on instructions from the controller, and that the obligations incumbent on the data controller shall also be incumbent on the processor, inter alia:

a) The data processor must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

b) The measures indicated above must ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected, according to the state of the art and the cost of their implementation.

8.2 If it is necessary to enter into an agreement, what are the formalities of that agreement (e.g., in writing, signed, etc.) and what issues must it address (e.g., only processing personal data in accordance with relevant instructions, keeping personal data secure, etc.)?

The carrying out of processing by way of a processor must be governed by a contract or legal act binding the processor to the controller and stipulating, in particular, that the processor shall act only on instructions from the controller, and that the obligations set out in paragraphs a) and b) above shall also be incumbent on the processor.

For the purposes of keeping proof, the parties of the contract or the legal act relating to data protection, and the requirements relating to the measures referred to in the previous question, must be in writing, in a document with legally recognised probative value.

9. Marketing

9.1 Please describe any legislative restrictions on the sending of electronic direct marketing (e.g., for marketing by email or SMS, is there a requirement to obtain prior opt-in consent of the recipient?).

As indicated above, data shall be collected for specific, determined and lawful purposes, which are directly related to the activity of the data controller, and cannot subsequently be processed in a way that is incompatible with those purposes (article 5, paragraph 1, subparagraph 2 of the LPDP).

Also, as stated in question 4.1 above, the processing of personal data may only be carried out if the data subject has given his/her unequivocal consent, or if the processing is necessary to the cases referred to in article 6 of the LPDP.

Hence, if the processor has declared marketing communications (be it via electronic direct marketing or via other means) as one of the purposes of processing, and if the data subject has given his/her consent to such purpose, such processing is lawful under the LPDP.

9.2 Please describe any legislative restrictions on the sending of marketing via other means (e.g., for marketing by telephone, a national opt-out register must be checked in advance; for marketing by post, there are no consent or opt-out requirements, etc.).

Please see question 9.1 above.

9.3 Do the restrictions noted above apply to marketing sent from other jurisdictions?

Please see question 9.1 above. Also, regarding certain industries (e.g. banking and financial industries), the sending of marketing is specifically forbidden to prospective clients without the entity being duly licensed in the MSAR.

Please note that, to the best of our knowledge, such data is not publicly available.

9.5 Is it lawful to purchase marketing lists from third parties? If so, are there any best practice recommendations on using such lists?

No specific provisions exist regarding such purchase, although said purchase might constitute an unlawful transfer of personal data if proper consent from the data subject has not been sought.

9.6 What are the maximum penalties for sending marketing communications in breach of applicable restrictions?

If the measures indicated in question 9.1 have not been taken, the entity responsible for treatment is liable to an administrative offence, punishable with a fine of between 8,000 and 80,000 MOP, for non-compliance with the obligations under article 6 of the LPDP (article 33 of the LPDP).

10. Cookies

10.1 Please describe any legislative restrictions on the use of cookies (or similar technologies).

The LPDP does not specifically provide for the use of cookies – hence, opt-in consent must be sought from the data subject.

10.2 Do the applicable restrictions (if any) distinguish between different types of cookies? If so, what are the relevant factors?

This is not applicable.

10.3 To date, has/have the relevant data protection authority(ies) taken any enforcement action in relation to cookies?

This is not applicable.

10.4 What are the maximum penalties for breaches of applicable cookie restrictions?

This is not applicable.

11. Restrictions on International Data Transfers

11.1 Please describe any restrictions on the transfer of personal data to other jurisdictions.

The transfer of personal data abroad can only take place under the stipulations of the LPDP and only if the legal order to which data are transferred ensures an adequate level of protection. Such level of protection is assessed by the GPDP on a case-by-case basis (article 19 of the LPDP).

The transfer of data abroad may be possible under the exceptions provided by the LPDP, which include the need of such transfer for the formation of a contract between the data subject and the data controller, and for preliminary measures for the formation of said contract by request of the data subject, among others.

However, the most common exception to the rule indicated above is the obtaining of the data subject’s unequivocal consent to the transfer (article 20, paragraph 1 of the LPDP).

11.3 Do transfers of personal data to other jurisdictions require registration/notification or prior approval from the relevant data protection authority(ies)? Please describe which types of transfers require approval or notification, what those steps involve, and how long they typically take.

As no list of legal orders ensuring an adequate level of protection currently exists, the transfer of personal data abroad is subject to prior authorisation by the GPDP, as indicated above. If unequivocal consent of the data subject is obtained, or if the situation under analysis falls under one of the exceptions provided by the LPDP, a simple notification is enough.

No timeframe currently exists for the procedure of assessment of the level of protection of a given legal order by the GPDP.

12. Whistle-blower Hotlines

12.1 What is the permitted scope of corporate whistle-blower hotlines (e.g., restrictions on the types of issues that may be reported, the persons who may submit a report, the persons whom a report may concern, etc.)?

No provisions exist in the LPDP regarding whistle-blower hotlines; neither is any binding guidance issued by the GPDP. As indicated in question 5.1 above, the LPDP provides for the possibility to submit a complaint to the GPDP, without prejudice to the possibility of resorting to administrative or jurisdictional means to guarantee compliance with legal and regulatory provisions (article 28 of the LPDP).

12.2 Is anonymous reporting prohibited, strongly discouraged, or generally permitted? If it is prohibited or discouraged, how do businesses typically address this issue?

No provisions exist in the LPDP regarding this issue and, to the best of our knowledge, there is no binding guidance on this matter.

13. CCTV

13.1 Does the use of CCTV require separate registration/notification or prior approval from the relevant data protection authority(ies), and/or any specific form of public notice (e.g., a high-visibility sign)?

The LPDP applies to video surveillance and to other means of capturing, processing and disseminating sounds and images to identify persons, whenever the controller is domiciled or headquartered in the MSAR, or uses a provider of access to computer and telematic networks established there (article 3, paragraph 3 of the LPDP).

No other specific stipulations exist for video surveillance, with the exception of Law no. 2/2012, of March 19, which establishes the legal framework of video surveillance in public spaces by the security forces and services of the MSAR.

As the use of CCTV is a separate processing of data, it shall require a separate notification to the GPDP under the law.

13.2 Are there limits on the purposes for which CCTV data may be used?

In accordance with GPDP guidelines, and without prejudice to the principles of purpose limitation and proportionality set out in the question above, data controllers shall obey the following rules regarding CCTV in order not to violate the PDPA regime, as well as other stipulations contained in other legislation such as the Macau Penal Code:

■ Only images can be recorded, not sound.

■ The camera cannot be hidden and its existence must be publicised.

■ The system cannot be connected to a public network (for instance, Wi-Fi networks or remote control functions).

■ The areas covered by the footage should not be excessive, i.e. they should not include neighbouring areas.

■ Security must be the exclusive purpose of data collection.

■ Third parties cannot have access to the data, except when allowed by law.

■ It is forbidden to replay recorded footage.

■ The data can only be preserved for six months.

14. Employee Monitoring

14.1 What types of employee monitoring are permitted (if any), and in what circumstances?

Without prejudice to the data which shall be mandatorily collected by the employer under the Macau Labour Law, no specific provision exists on this matter.

Therefore, employee monitoring is possible if it is necessary under the cases provided by the LPDP, or if consent has been sought.

Under the LPDP, the processing of data can only take place if the data subject has given his/her unequivocal consent to the transfer, or if that transfer is necessary under the cases provided by law (see “Key Principles” above).

As indicated above, the LPDP also allows for the processing of data if such processing is necessary for pursuing legitimate interests of the data controller or third party to whom the data are communicated, insofar as the interests or rights, freedoms and guarantees of the data subject do not prevail.

In the case of employee monitoring, the usual procedure to obtain consent would be to prepare an appropriate declaration of consent describing the applicable rules and rights of the data subject/employee under the LPDP.

14.3 To what extent do works councils/trade unions/employee representatives need to be notified or consulted?

No specific provisions exist on this matter.

15. Data Security and Data Breach

15.1 Is there a general obligation to ensure the security of personal data? If so, which entities are responsible for ensuring that data are kept secure (e.g., controllers, processors, etc.)?

Yes – in accordance with the LPDP, the data controller shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, accidental loss, unauthorised disclosure or access, inter alia, when processing involves transmission over a network, and against any form of unlawful processing, having regard to the available technical knowledge and to the costs resulting from its implementation, an adequate level of security with regard to the risks involved with the processing and the nature of the data to be protected (article 15, paragraph 1 of the LPDP).

The LPDP also provides for special security measures in case of sensitive data processing and of the creation and maintenance of records regarding suspicions of illegal activities, criminal offences and administrative offences (article 7, paragraph 2, article 8, paragraph 1 and article 16, paragraph 1 of the LPDP), namely appropriate measures to:

■ prevent unauthorised access to the premises used for the processing of such data (control of entry to the premises);

■ prevent data carriers from being read, copied, altered or removed by an unauthorised person (control of data carriers);

■ prevent automated data processing systems from being used by unauthorised persons through data transmission facilities (monitoring of use);

■ ensure that authorised persons can only access the data covered by the authorisation (access control);

■ ensure the verification of entities to whom personal data may be transmitted through data transmission facilities (transmission control);

■ ensure that there is a posteriori verification, within a period appropriate to the nature of the processing, to be laid down in the rules applicable to each sector, of the personal data to be introduced, when and by whom (introduction control); and

■ prevent the data from being read, copied, altered or disposed of in an unauthorised manner during the transmission of personal data and in the transport of its medium (transport control).

Also, the LPDP requires that the systems must ensure the logical separation of data on health and sexual life, including genetic data, from other personal data (article 16, paragraphs 1 and 3 of the LPDP).

In case of sensitive data indicated in article 7 of the LPDP, the GPDP may require the encryption of data for transmissions over a network, if said transmission may imperil rights, freedoms and guarantees of the data subjects (article 16, paragraph 4 of the LPDP).

15.2 Is there a legal requirement to report data breaches to the relevant data protection authority(ies)? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expect(s) voluntary breach reporting.

No specific provision exists on this matter.

15.3 Is there a legal requirement to report data breaches to affected data subjects? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expect(s) voluntary breach reporting.

Without prejudice to the right of information, which may be exercised by the data subject, no specific provision exists on this matter.

15.4 What are the maximum penalties for data security breaches?

Non-compliance with the special security measures for sensitive data processing and for the creation and maintenance of records regarding suspicions of illegal activities, criminal offences and administrative offences, set out in article 16 of the LPDP and described in question 15.1 above, is an administrative offence which may entail a fine between 4,000 and 40,000 MOP.

Although the LPDP provides penalties for undue access, as well as for tampering or the destruction of personal data, it does not specifically provide for security breaches by the data controller. It should be noted, however, that the LPDP mandates that the data controller shall present the notification/authorisation request with a general description of the security measures indicated in question 15.1 above, so that the GPDP may evaluate the adequacy of such measures. If the GPDP notifies the above-mentioned entity to address any insufficiency in the security measures and no remedy is taken, then a fine of between 2,000 and 20,000 MOP for individuals and a fine of between 10,000 and 100,000 MOP for legal persons may be imposed.

In case of wrongful or undue access to personal data by any entity who is not entitled to do so, the LPDP stipulates, as a maximum penalty, two years of imprisonment or a fine of up to 240 days (unless a more severe penalty exists by special law).

16. Enforcement and Sanctions

16.1 Describe the enforcement powers of the data protection authority(ies).

Investigatory Power

Civil/Administrative

Sanction

Criminal

Sanction

Non-compliance with notification of data processing/compliance in breach of the terms set out in article 23 of the LPDP, providing false information, after notification by the GPDP and maintaining access to open data transmission networks for the data controllers which do not comply with the provisions of the LPDP.

A fine of between 2,000 and 20,000 MOP for individuals and a fine of between 10,000 and 100,000 MOP for legal persons; the fines are increased to twice the amount indicated above if the data are subject to prior authorisation.

N/A

Non-compliance with stipulations of the LPDP regarding:

1) data quality (article 5);

2) right to information, access, objection, right not to be subject to automated individual decisions (articles 10 to 13);

5) transfer of data to a destination outside the MSAR and respective exemptions (articles 19 and 20).

A fine of between 8,000 and 80,000 MOP.

N/A

Non-compliance with stipulations of the LPDP regarding:

■ purposely omitting the notification/authorisation indicated in articles 21 and 22 of the LPDP;

■ providing false information in the notification/authorisation requests for the processing of personal data or making modifications in this request not allowed by the instrument of legalisation;

■ diverting or using personal data, in a manner incompatible with the purpose of the collection or with the instrument of legalisation;

■ promoting or carrying out an illegal interconnection of personal data;

■ non-compliance with the obligations provided for in this law or in other data protection legislation in the period established by the GPDP; and

■ maintaining access to open data transmission networks for those responsible for the processing of personal data that do not comply with the provisions of this law, after notification of the GPDP, not to do so.

N/A

Imprisonment of up to one year or a fine of up to 120 days.

The sanction is increased to twice the duration indicated above if the data involves sensitive data (article 7 of the LPDP) or suspicions of illegal activities, criminal offences and administrative offences (article 8 of the LPDP).

Access in any way to personal data whose access is forbidden to said individual/entity. The sanction is increased to twice the duration indicated when access:

■ is achieved through violation of technical safety rules;

■ has allowed the agent or third parties the obtainment of personal data; or

■ has provided the agent or third parties with a benefit or patrimonial advantage.

Deletion, destruction, damaging, suppression or modification of personal data without proper authorisation, rendering the data unusable or affecting their ability to be used.

Qualified disobedience regarding notification to interrupt, cease or block the processing of personal data, or in cases of:

■ refusal, without just cause, to cooperate as specifically requested by the GPDP;

■ refusal to totally or partially destroy personal data; and/or

■ refusal to destroy personal data, after the period of conservation provided for in the LPDP.

N/A

Imprisonment of up to one year or a fine of up to 120 days, unless otherwise provided by special law.

The sanction is increased to twice the duration indicated in the cases provided.

Imprisonment of up to two years or a fine of up to 240 days, unless otherwise provided by special law.

The sanction is increased to twice the duration indicated if the damage resulting therefrom is particularly serious.

If the agent acts with negligence, the sanction is, in both cases provided above, imprisonment of up to one year or a fine of up to 120 days.

Imprisonment of up to two years or a fine of up to 240 days.

16.2 Does the data protection authority have the power to issue a ban on a particular processing activity? If so, does such a ban require a court order?

The GPDP, as the public authority referred to in the LPDP (as well as in article 79 of the Macau Civil Code), carries out the tasks conferred upon it and is (inter alia) responsible for the supervision and coordination of compliance with and enforcement of the LPDP, as well as for the establishment of the secrecy regime and supervision of its execution.

The GPDP is also responsible for encouraging and supporting the development of codes of conduct designed to contribute, depending on the characteristics of the different sectors, to the proper implementation of the provisions of the LPDP and, in general, to greater effectiveness of self-regulation and protection of fundamental rights related to the protection of privacy.

As no specific provision exists regarding the possibility of the GPDP issuing a ban on a particular processing activity, and without prejudice to the guidelines that the GPDP may establish, we are of the view that such possibility is not within the powers of the public authority.

16.3 Describe the data protection authority’s approach to exercising those powers, with examples of recent cases.

Please note that, to the best of our knowledge, such data is not publicly available.

16.4 Does the data protection authority ever exercise its powers against businesses established in other jurisdictions? If so, how is this enforced?

Please note that, to the best of our knowledge, such data is not publicly available.

17. E-discovery / Disclosure to Foreign Law Enforcement Agencies

17.1 How do businesses typically respond to foreign e-discovery requests, or requests for disclosure from foreign law enforcement agencies?

Please note that, to the best of our knowledge, such data is not publicly available.

■ Registration of visitors’ personal data when entering a building (investigation no. 0091/2017/IP).

■ Reading of a marriage record in the processing of a wedding transcription (investigation no. 0094/2017/IP).

18.2 What “hot topics” are currently a focus for the data protection regulator?

In 2018, the GPDP issued an opinion on the processing of personal data arising from the use of video recording cameras in police uniforms (investigation no. 0003/P/2018/GPDP), recommending a redrafting of the purposes of such recording under the LPDP.

The International Comparative Legal Guides and the International Business Reports are published by: Global Legal Group

My U.S. based insurance agency specializes in providing insurance for firms with worldwide operations. The content on the Global Legal Group website has been a wealth of information in helping our clients to access their worldwide products liability exposures in multiple jurisdictions. I recommend Global Legal Group to my clients who need counsel in this specialized area.John Sadler, President - SADLER & COMPANY INC., USA